In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

To conduct an effective fault tree analysis or FMEA requires safety analysts to havea very good understanding of the system and all its components. Experts have notedthat design engineers and safety analysts generally work with different views of thesystem’s design. This can lead to potential problems with consistency andcompleteness of understanding between the two groups. A recent US NationalAeronautics and Space Administration (NASA) research report (Joshi et al. 2006)noted:Safety engineers traditionally perform analysis, such as fault tree analysis,based on information synthesized from several sources, including informaldesign models and requirements documents. Unfortunately, these analyses arehighly subjective and dependent on the skill of the engineer. Fault trees areone of the most common techniques used by safety engineers, yet differentsafety engineers will often produce fault trees for the same system that differin substantive ways. The final fault tree is often produced only through aprocess of review and consensus building between the system and safetyengineers. Even after a consensus is reached, it is unlikely that the analysisresults will be complete, consistent, and error free due in part to the informalmodels used as the basis of the analysis. In fact, the lack of precise models ofthe system architecture and its failure modes often forces the safety analysts todevote much of their effort to gathering information about the systemarchitecture and system behavior and embedding this information in the safetyartifacts such as the fault trees.In summary, the task of identifying scenarios that lead to failure conditions requiresexpertise and a detailed knowledge of the proposed system design. However, assystem designs get more complex, then traditional safety assessment activitiesbecome inefficient and difficult to use successfully.Formal methods and model-based safety analysisThe term ‘formal methods’ refers to the use of mathematical techniques in thedesign and evaluation of complex systems. NASA (1995) stated:Formal Methods (FM) consist of a set of techniques and tools based onmathematical modeling and formal logic that are used to specify and verifyrequirements and designs for computer systems and software. The use of FMon a project can assume various forms, ranging from occasional mathematicalnotation embedded in English specifications, to fully formal specificationsusing specification languages with a precise semantics. At their most rigorous,FM involve computer-assisted proofs of key properties regarding the behaviorof the system.The use of formal methods in the development of complex systems has beengrowing for over 20 years. For aviation applications, the use of formal methods wasinitially focused on the development of requirements. For example, thedevelopment of the functional requirements for the A320 and A330/A340 werebased on formal methods, and these were used to develop models that could be usedto conduct simulations for validating the EFCS system design (section 2.4.3).In recent years, there has been considerable interest in using formal methods tocreate a system model, and then using the model to automate some of the safetyassessment tasks. Proponents have argued that this approach enables the designengineers and safety analysts to work with the same view of the system, and toprovide better assurance that design errors will be identified in a more efficientmanner (Pumphrey 2001, Joshi et al. 2006).- 105 -